 
 (defn readable-s3-url
   [{:aws/keys [credentials-provider] region :aws-region :as config} expires-seconds path]
-  (let [[api-key _] (credentials-provider)
+  (let [[api-key _ ?security-token] (credentials-provider)
         utc-now (aws/utc-now)
         query-str (str "X-Amz-Algorithm=AWS4-HMAC-SHA256"
                        "&X-Amz-Credential=" api-key "/" (.format utc-now aws/basic-date-format) "/" region "/s3/aws4_request"

(defn generate-s3-upload-policy
  [{:aws/keys [credentials-provider] region :aws-region bucket :aws-bucket :as config} {:keys [starts-with]}]
  (when credentials-provider
    (let [[api-key api-secret] (credentials-provider)
          utc-now (aws/utc-now)
          day (.format utc-now aws/basic-date-format)
          date (.format utc-now aws/basic-date-time-format)

                       {"x-amz-algorithm" "AWS4-HMAC-SHA256"}
                       {"x-amz-credential" credential}
                       {"x-amz-date" date}]}
                     (cond-> ?security-token
                       (update :conditions conj
                               {"x-amz-security-token" ?security-token}))
                     json/write-str
                     aws/str->bytes
                     Base64/encodeBase64String)]
